LibWeb: Protect RadioButton and TextNode against mutating DOM

RadioButton had some protection, but also needed to be protected against
click events originating from its associated label.

2 files changed, 7 insertions, 0 deletions

diff --git a/Userland/Libraries/LibWeb/Layout/RadioButton.cpp b/Userland/Libraries/LibWeb/Layout/RadioButton.cpp
index 1574c86096..f20b5b338e 100644
--- a/Userland/Libraries/LibWeb/Layout/RadioButton.cpp
+++ b/Userland/Libraries/LibWeb/Layout/RadioButton.cpp
@@ -115,6 +115,9 @@ void RadioButton::handle_associated_label_mousedown(Badge<Label>)
 
 void RadioButton::handle_associated_label_mouseup(Badge<Label>)
 {
+    // NOTE: Changing the checked state of the DOM node may run arbitrary JS, which could disappear this node.
+    NonnullRefPtr protect = *this;
+
     set_checked_within_group();
     m_being_pressed = false;
 }
diff --git a/Userland/Libraries/LibWeb/Layout/TextNode.cpp b/Userland/Libraries/LibWeb/Layout/TextNode.cpp
index cfa20a2957..8c0eb48ddc 100644
--- a/Userland/Libraries/LibWeb/Layout/TextNode.cpp
+++ b/Userland/Libraries/LibWeb/Layout/TextNode.cpp
@@ -324,6 +324,10 @@ void TextNode::handle_mouseup(Badge<EventHandler>, const Gfx::IntPoint& position
 {
     if (!parent() || !is<Label>(*parent()))
         return;
+
+    // NOTE: Changing the state of the DOM node may run arbitrary JS, which could disappear this node.
+    NonnullRefPtr protect = *this;
+
     downcast<Label>(*parent()).handle_mouseup_on_label({}, position, button);
     frame().event_handler().set_mouse_event_tracking_layout_node(nullptr);
 }